Gitops Cluster Debug
- 533 installs
- 202 repo stars
- Updated August 4, 2026
- fluxcd/agent-skills
gitops-cluster-debug is a Flux CD cluster troubleshooting skill that traces failing GitOps reconciliations on live Kubernetes clusters for developers debugging stuck HelmReleases, Kustomizations, or controller errors.
About
gitops-cluster-debug is a Flux CD agent skill for debugging GitOps pipelines on live Kubernetes clusters through the flux-operator-mcp server. It inspects FluxInstance readiness, controller deployments, HelmRelease and Kustomization status conditions, ResourceSet input providers, artifact sources, managed resource inventories, and pod logs. Five structured debugging workflows cover installation health checks, HelmRelease tracing, Kustomization tracing, ResourceSet dependency analysis, and Kubernetes log analysis. The skill indexes 17 Flux CRD OpenAPI schemas—from FluxInstance and ResourceSet through GitRepository, HelmRelease v2, and ImageUpdateAutomation—and produces markdown reports with summary, dependency chains, root cause evidence, and prioritized remediation steps. Developers reach for gitops-cluster-debug when Flux resources report Not Ready, reconciliation errors, artifact pull failures, or controller crashloops on production clusters.
- gitops-cluster-debug
- Development
Gitops Cluster Debug by the numbers
- 533 all-time installs (skills.sh)
- Ranked #746 of 4,347 Backend & APIs skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/fluxcd/agent-skills --skill gitops-cluster-debugAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 533 |
|---|---|
| repo stars | ★ 202 |
| Last updated | August 4, 2026 |
| Repository | fluxcd/agent-skills ↗ |
Why is my Flux HelmRelease failing reconciliation?
For development and infrastructure management.
Who is it for?
Platform and SRE engineers operating Flux CD on live Kubernetes clusters who need live resource inspection beyond local manifest editing.
Skip if: Developers authoring new Kubernetes YAML locally without a running Flux installation or clusters without the flux-operator-mcp server connected.
When should I use this skill?
Flux resources on a cluster are failing, stuck, not ready, or controllers show reconciliation errors, artifact pull failures, or crashloops.
What you get
Markdown root-cause reports with dependency chains, status condition analysis, controller log findings, and prioritized remediation steps.
- Root-cause debug reports
- Dependency chain traces
- Remediation recommendations
By the numbers
- Documents 5 structured debugging workflows for installation, HelmRelease, Kustomization, ResourceSet, and logs
- Indexes 17 Flux CRD OpenAPI schema files in assets/schemas/
Files
Flux Cluster Debugger
You are a Flux cluster debugger specialized in troubleshooting GitOps pipelines on live Kubernetes clusters. You use the flux-operator-mcp MCP tools to connect to clusters, fetch Flux and Kubernetes resources, analyze status conditions, inspect logs, and identify root causes.
General Rules
- Don't assume the
apiVersionof any Kubernetes or Flux resource — call
get_kubernetes_api_versions to find the correct one.
- To determine if a Kubernetes resource is Flux-managed, look for
fluxcdlabels in
the resource metadata.
- After switching context to a new cluster, always call
get_flux_instanceto determine
the Flux Operator status, version, and settings before doing anything else.
- When creating or updating resources on the cluster, generate a Kubernetes YAML manifest
and call the apply_kubernetes_resource tool. Do not apply resources unless explicitly requested by the user. Before generating any YAML manifest, read the relevant OpenAPI schema from assets/schemas/ to verify the exact field names and nesting. Schema files follow the naming convention {kind}-{group}-{version}.json (see the CRD reference table below).
- You will not be able to read the values of Kubernetes Secrets, the MCP server will return only the
datafield with keys but empty values.
Cluster Context
If the user specifies a cluster name:
1. Call get_kubeconfig_contexts to list available contexts. 2. Find the context matching the user's cluster name. 3. Call set_kubeconfig_context to switch to it. 4. Call get_flux_instance to verify the Flux installation on that cluster.
If no cluster is specified, debug on the current context. Still call get_flux_instance at the start to understand the Flux installation.
Debugging Workflows
Adapt the depth based on what the user asks for. A targeted question ("why is my HelmRelease failing?") can skip straight to the relevant workflow. A broad request ("debug my cluster") should start with the installation check.
Workflow 1: Flux Installation Check
1. Call get_flux_instance to check the Flux Operator status and settings. 2. Verify the FluxInstance reports Ready: True. 3. Check controller deployment status — all controllers should be running. 4. Review the FluxReport for cluster-wide reconciliation summary. 5. If controllers are not running or crashlooping, analyze their logs using get_kubernetes_logs on the controller pods.
Workflow 2: HelmRelease Debugging
Follow these steps when troubleshooting a HelmRelease:
1. Call get_flux_instance to check the helm-controller deployment status and the apiVersion of the HelmRelease kind. 2. Call get_kubernetes_resources to get the HelmRelease, then analyze the spec, status, inventory, and events. 3. Determine which Flux object manages the HelmRelease by looking at the annotations — it can be a Kustomization or a ResourceSet. 4. If valuesFrom is present, get all the referenced ConfigMap and Secret resources. 5. Identify the HelmRelease source by looking at the chartRef or sourceRef field. 6. Call get_kubernetes_resources to get the source, then analyze the source status and events. 7. If the HelmRelease is in a failed state or in progress, check the managed resources found in the inventory. 8. Call get_kubernetes_resources to get the managed resources and analyze their status. 9. If managed resources are failing, analyze their logs using get_kubernetes_logs. 10. Create a root cause analysis report. If no issues are found, report the current status of the HelmRelease and its managed resources and container images.
Workflow 3: Kustomization Debugging
Follow these steps when troubleshooting a Kustomization:
1. Call get_flux_instance to check the kustomize-controller deployment status and the apiVersion of the Kustomization kind. 2. Call get_kubernetes_resources to get the Kustomization, then analyze the spec, status, inventory, and events. 3. Determine which Flux object manages the Kustomization by looking at the annotations — it can be another Kustomization or a ResourceSet. 4. If substituteFrom is present, get all the referenced ConfigMap and Secret resources. 5. Identify the Kustomization source by looking at the sourceRef field. 6. Call get_kubernetes_resources to get the source, then analyze the source status and events. 7. If the Kustomization is in a failed state or in progress, check the managed resources found in the inventory. 8. Call get_kubernetes_resources to get the managed resources and analyze their status. 9. If managed resources are failing, analyze their logs using get_kubernetes_logs. 10. Create a root cause analysis report. If no issues are found, report the current status of the Kustomization and its managed resources.
Workflow 4: ResourceSet Debugging
Follow these steps when troubleshooting a ResourceSet:
1. Call get_flux_instance to check the Flux Operator status and the apiVersion of the ResourceSet kind. 2. Call get_kubernetes_resources to get the ResourceSet, then analyze the spec, status conditions, and events. 3. If the ResourceSet uses inputsFrom, get each referenced ResourceSetInputProvider and check its status. A Stalled or Ready: False provider means the ResourceSet has no inputs to render. 4. If the ResourceSet has dependsOn, get each dependency and verify it is Ready. ResourceSet dependencies can reference any Kubernetes resource kind (other ResourceSets, Kustomizations, HelmReleases, CRDs) — check the apiVersion and kind in each entry. 5. Check the ResourceSet inventory for generated resources. Get the generated Kustomizations, HelmReleases, or other Flux resources and analyze their status. 6. If generated resources are failing, follow Workflow 2 (HelmRelease) or Workflow 3 (Kustomization) to debug them individually. 7. Create a root cause analysis report. Distinguish between ResourceSet-level failures (template errors, missing inputs, RBAC) and failures in the generated resources.
Workflow 5: Kubernetes Logs Analysis
When analyzing logs for any workload:
1. Get the Kubernetes Deployment that manages the pods using get_kubernetes_resources. 2. Extract the matchLabels and container name from the deployment spec. 3. List the pods with get_kubernetes_resources using the found matchLabels. 4. Get the logs by calling get_kubernetes_logs with the pod name and container name. 5. Analyze the logs for errors, warnings, and patterns that indicate the root cause.
Flux CRD Reference
Use this table to check API versions and read the OpenAPI schema when needed.
| Controller | Kind | apiVersion | OpenAPI Schema |
|---|---|---|---|
| flux-operator | FluxInstance | fluxcd.controlplane.io/v1 | fluxinstance-fluxcd-v1.json |
| flux-operator | FluxReport | fluxcd.controlplane.io/v1 | fluxreport-fluxcd-v1.json |
| flux-operator | ResourceSet | fluxcd.controlplane.io/v1 | resourceset-fluxcd-v1.json |
| flux-operator | ResourceSetInputProvider | fluxcd.controlplane.io/v1 | resourcesetinputprovider-fluxcd-v1.json |
| source-controller | GitRepository | source.toolkit.fluxcd.io/v1 | gitrepository-source-v1.json |
| source-controller | OCIRepository | source.toolkit.fluxcd.io/v1 | ocirepository-source-v1.json |
| source-controller | Bucket | source.toolkit.fluxcd.io/v1 | bucket-source-v1.json |
| source-controller | HelmRepository | source.toolkit.fluxcd.io/v1 | helmrepository-source-v1.json |
| source-controller | HelmChart | source.toolkit.fluxcd.io/v1 | helmchart-source-v1.json |
| source-controller | ExternalArtifact | source.toolkit.fluxcd.io/v1 | externalartifact-source-v1.json |
| source-watcher | ArtifactGenerator | source.extensions.fluxcd.io/v1beta1 | artifactgenerator-source-v1beta1.json |
| kustomize-controller | Kustomization | kustomize.toolkit.fluxcd.io/v1 | kustomization-kustomize-v1.json |
| helm-controller | HelmRelease | helm.toolkit.fluxcd.io/v2 | helmrelease-helm-v2.json |
| notification-controller | Provider | notification.toolkit.fluxcd.io/v1beta3 | provider-notification-v1beta3.json |
| notification-controller | Alert | notification.toolkit.fluxcd.io/v1beta3 | alert-notification-v1beta3.json |
| notification-controller | Receiver | notification.toolkit.fluxcd.io/v1 | receiver-notification-v1.json |
| image-reflector-controller | ImageRepository | image.toolkit.fluxcd.io/v1 | imagerepository-image-v1.json |
| image-reflector-controller | ImagePolicy | image.toolkit.fluxcd.io/v1 | imagepolicy-image-v1.json |
| image-automation-controller | ImageUpdateAutomation | image.toolkit.fluxcd.io/v1 | imageupdateautomation-image-v1.json |
Loading References
Load reference files when you need deeper information:
- [flux-crds.md](references/flux-crds.md) — When you need detailed CRD field descriptions, status conditions, common failures, or the resource relationship diagram
- [troubleshooting.md](references/troubleshooting.md) — When diagnosing a specific failure pattern or when you need the general debugging checklist
Report Format
As you trace through any debugging workflow, record each resource you inspect (kind, name, namespace, status) to build the dependency chain for the report.
Structure debugging findings as a markdown report with these sections:
1. Summary — cluster name, Flux version, resource under investigation, current status 2. Resource Analysis — detailed breakdown of the resource spec, status conditions, and events 3. Dependency Chain — trace from source to applier to managed resources (e.g., GitRepository → Kustomization → Deployments) 4. Root Cause — identified root cause with evidence from status conditions, events, and logs 5. Recommendations — prioritized steps to resolve the issue, with exact commands or manifest changes
Edge Cases
- No Flux installed: If
get_flux_instancereturns no FluxInstance, tell the user that Flux is not installed on the cluster. Suggest installing the Flux Operator. - MCP server unavailable: If MCP tools fail to connect, tell the user that the
flux-operator-mcpserver is not running. Provide the install command. - Suspended resources: If a Flux resource has
.spec.suspend: true, note that it is intentionally suspended and won't reconcile until resumed. Don't flag this as an error unless the user expects it to be active. - Progressing resources: If a resource shows
Ready: Unknownwith reasonProgressing, it is actively reconciling. Wait for the reconciliation to complete before diagnosing. Note the last transition time. - Flux-managed resources: Resources with
fluxcdlabels are managed by Flux. Warn the user before applying manual changes — Flux will revert them on the next reconciliation. - Stale status: If the last reconciliation time is old relative to the configured interval, the controller may be overloaded or stuck. Check controller logs for backpressure or errors.
- Cluster context not found: If the user's cluster name doesn't match any available context, list the available contexts and ask the user to clarify.
{
"description": "Alert is the Schema for the alerts API",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"description": "AlertSpec defines an alerting rule for events involving a list of objects.",
"properties": {
"eventMetadata": {
"additionalProperties": {
"type": "string"
},
"description": "EventMetadata is an optional field for adding metadata to events dispatched by the\ncontroller. This can be used for enhancing the context of the event. If a field\nwould override one already present on the original event as generated by the emitter,\nthen the override doesn't happen, i.e. the original value is preserved, and an info\nlog is printed.",
"type": "object"
},
"eventSeverity": {
"default": "info",
"description": "EventSeverity specifies how to filter events based on severity.\nIf set to 'info' no events will be filtered.",
"enum": [
"info",
"error"
],
"type": "string"
},
"eventSources": {
"description": "EventSources specifies how to filter events based\non the involved object kind, name and namespace.",
"items": {
"description": "CrossNamespaceObjectReference contains enough information to let you locate the\ntyped referenced object at cluster level",
"properties": {
"apiVersion": {
"description": "API version of the referent",
"type": "string"
},
"kind": {
"description": "Kind of the referent",
"enum": [
"Bucket",
"GitRepository",
"Kustomization",
"HelmRelease",
"HelmChart",
"HelmRepository",
"ImageRepository",
"ImagePolicy",
"ImageUpdateAutomation",
"OCIRepository",
"ArtifactGenerator",
"ExternalArtifact"
],
"type": "string"
},
"matchLabels": {
"additionalProperties": {
"type": "string"
},
"description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\nMatchLabels requires the name to be set to `*`.",
"type": "object"
},
"name": {
"description": "Name of the referent\nIf multiple resources are targeted `*` may be set.",
"maxLength": 253,
"minLength": 1,
"type": "string"
},
"namespace": {
"description": "Namespace of the referent",
"maxLength": 253,
"minLength": 1,
"type": "string"
}
},
"required": [
"kind",
"name"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"exclusionList": {
"description": "ExclusionList specifies a list of Golang regular expressions\nto be used for excluding messages.",
"items": {
"type": "string"
},
"type": "array"
},
"inclusionList": {
"description": "InclusionList specifies a list of Golang regular expressions\nto be used for including messages.",
"items": {
"type": "string"
},
"type": "array"
},
"providerRef": {
"description": "ProviderRef specifies which Provider this Alert should use.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"summary": {
"description": "Summary holds a short description of the impact and affected cluster.",
"maxLength": 255,
"type": "string"
},
"suspend": {
"description": "Suspend tells the controller to suspend subsequent\nevents handling for this Alert.",
"type": "boolean"
}
},
"required": [
"eventSources",
"providerRef"
],
"type": "object",
"additionalProperties": false
},
"status": {
"default": {
"observedGeneration": -1
},
"description": "AlertStatus defines the observed state of the Alert.",
"properties": {
"conditions": {
"description": "Conditions holds the conditions for the Alert.",
"items": {
"description": "Condition contains details for one aspect of the current state of this API Resource.",
"properties": {
"lastTransitionTime": {
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
"maxLength": 32768,
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
"format": "int64",
"minimum": 0,
"type": "integer"
},
"reason": {
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
"maxLength": 1024,
"minLength": 1,
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
"type": "string"
},
"status": {
"description": "status of the condition, one of True, False, Unknown.",
"enum": [
"True",
"False",
"Unknown"
],
"type": "string"
},
"type": {
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
"maxLength": 316,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"lastHandledReconcileAt": {
"description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
"type": "string"
},
"observedGeneration": {
"description": "ObservedGeneration is the last observed generation.",
"format": "int64",
"type": "integer"
}
},
"type": "object",
"additionalProperties": false
}
},
"type": "object"
}{
"description": "Alert is the Schema for the alerts API",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"description": "AlertSpec defines an alerting rule for events involving a list of objects.",
"properties": {
"eventMetadata": {
"additionalProperties": {
"type": "string"
},
"description": "EventMetadata is an optional field for adding metadata to events dispatched by the\ncontroller. This can be used for enhancing the context of the event. If a field\nwould override one already present on the original event as generated by the emitter,\nthen the override doesn't happen, i.e. the original value is preserved, and an info\nlog is printed.",
"type": "object"
},
"eventSeverity": {
"default": "info",
"description": "EventSeverity specifies how to filter events based on severity.\nIf set to 'info' no events will be filtered.",
"enum": [
"info",
"error"
],
"type": "string"
},
"eventSources": {
"description": "EventSources specifies how to filter events based\non the involved object kind, name and namespace.",
"items": {
"description": "CrossNamespaceObjectReference contains enough information to let you locate the\ntyped referenced object at cluster level",
"properties": {
"apiVersion": {
"description": "API version of the referent",
"type": "string"
},
"kind": {
"description": "Kind of the referent",
"enum": [
"Bucket",
"GitRepository",
"Kustomization",
"HelmRelease",
"HelmChart",
"HelmRepository",
"ImageRepository",
"ImagePolicy",
"ImageUpdateAutomation",
"OCIRepository",
"ArtifactGenerator",
"ExternalArtifact"
],
"type": "string"
},
"matchLabels": {
"additionalProperties": {
"type": "string"
},
"description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\nMatchLabels requires the name to be set to `*`.",
"type": "object"
},
"name": {
"description": "Name of the referent\nIf multiple resources are targeted `*` may be set.",
"maxLength": 253,
"minLength": 1,
"type": "string"
},
"namespace": {
"description": "Namespace of the referent",
"maxLength": 253,
"minLength": 1,
"type": "string"
}
},
"required": [
"kind",
"name"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"exclusionList": {
"description": "ExclusionList specifies a list of Golang regular expressions\nto be used for excluding messages.",
"items": {
"type": "string"
},
"type": "array"
},
"inclusionList": {
"description": "InclusionList specifies a list of Golang regular expressions\nto be used for including messages.",
"items": {
"type": "string"
},
"type": "array"
},
"providerRef": {
"description": "ProviderRef specifies which Provider this Alert should use.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"summary": {
"description": "Summary holds a short description of the impact and affected cluster.\nDeprecated: Use EventMetadata instead.",
"maxLength": 255,
"type": "string"
},
"suspend": {
"description": "Suspend tells the controller to suspend subsequent\nevents handling for this Alert.",
"type": "boolean"
}
},
"required": [
"eventSources",
"providerRef"
],
"type": "object",
"additionalProperties": false
}
},
"type": "object"
}{
"description": "ArtifactGenerator is the Schema for the artifactgenerators API.",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"description": "ArtifactGeneratorSpec defines the desired state of ArtifactGenerator.",
"properties": {
"artifacts": {
"description": "OutputArtifacts is a list of output artifacts to be generated.",
"items": {
"description": "OutputArtifact defines the desired state of an ExternalArtifact\ngenerated by the ArtifactGenerator.",
"properties": {
"copy": {
"description": "Copy defines a list of copy operations to perform from the sources to the generated artifact.\nThe copy operations are performed in the order they are listed with existing files\nbeing overwritten by later copy operations.",
"items": {
"properties": {
"exclude": {
"description": "Exclude specifies a list of glob patterns to exclude\nfiles and dirs matched by the 'From' field.",
"items": {
"type": "string"
},
"maxItems": 100,
"type": "array"
},
"from": {
"description": "From specifies the source (by alias) and the glob pattern to match files.\nThe format is \"@<alias>/<glob-pattern>\".",
"maxLength": 1024,
"pattern": "^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$",
"type": "string"
},
"strategy": {
"description": "Strategy specifies the copy strategy to use.\n'Overwrite' will overwrite existing files in the destination.\n'Merge' is for merging YAML files using Helm values merge strategy.\n'Extract' is for extracting the contents of tarball archives (.tar.gz, .tgz)\nWhen using glob patterns, non-tarball files are silently skipped. For single file sources,\nthe file must be a tarball or an error is returned. Directories are not supported.\nIf not specified, defaults to 'Overwrite'.",
"enum": [
"Overwrite",
"Merge",
"Extract"
],
"type": "string"
},
"to": {
"description": "To specifies the destination path within the artifact.\nThe format is \"@artifact/path\", the alias \"artifact\"\nrefers to the root path of the generated artifact.",
"maxLength": 1024,
"pattern": "^@(artifact)/(.*)$",
"type": "string"
}
},
"required": [
"from",
"to"
],
"type": "object",
"additionalProperties": false
},
"minItems": 1,
"type": "array"
},
"name": {
"description": "Name is the name of the generated artifact.",
"maxLength": 253,
"pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
"type": "string"
},
"originRevision": {
"description": "OriginRevision is used to set the 'org.opencontainers.image.revision'\nannotation on the generated artifact metadata.\nIf specified, it must point to an existing source alias in the format \"@<alias>\".\nIf the referenced source has an origin revision (e.g. a Git commit SHA),\nit will be used to set the annotation on the generated artifact.\nIf the referenced source does not have an origin revision, the field is ignored.",
"maxLength": 64,
"pattern": "^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)$",
"type": "string"
},
"revision": {
"description": "Revision is the revision of the generated artifact.\nIf specified, it must point to an existing source alias in the format \"@<alias>\".\nIf not specified, the revision is automatically set to the digest of the artifact content.",
"maxLength": 64,
"pattern": "^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)$",
"type": "string"
}
},
"required": [
"copy",
"name"
],
"type": "object",
"additionalProperties": false
},
"maxItems": 1000,
"minItems": 1,
"type": "array"
},
"sources": {
"description": "Sources is a list of references to the Flux source-controller\nresources that will be used to generate the artifact.",
"items": {
"description": "SourceReference contains the reference to a Flux source-controller resource.",
"properties": {
"alias": {
"description": "Alias of the source within the ArtifactGenerator context.\nThe alias must be unique per ArtifactGenerator, and must consist\nof lower case alphanumeric characters, underscores, and hyphens.\nIt must start and end with an alphanumeric character.",
"maxLength": 63,
"pattern": "^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$",
"type": "string"
},
"kind": {
"description": "Kind of the source.",
"enum": [
"Bucket",
"GitRepository",
"OCIRepository",
"HelmChart",
"ExternalArtifact"
],
"type": "string"
},
"name": {
"description": "Name of the source.",
"maxLength": 253,
"pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
"type": "string"
},
"namespace": {
"description": "Namespace of the source.\nIf not provided, defaults to the same namespace as the ArtifactGenerator.",
"maxLength": 63,
"minLength": 1,
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
"type": "string"
}
},
"required": [
"alias",
"kind",
"name"
],
"type": "object",
"additionalProperties": false
},
"maxItems": 1000,
"minItems": 1,
"type": "array"
}
},
"required": [
"artifacts",
"sources"
],
"type": "object",
"additionalProperties": false
},
"status": {
"description": "ArtifactGeneratorStatus defines the observed state of ArtifactGenerator.",
"properties": {
"conditions": {
"description": "Conditions holds the conditions for the ArtifactGenerator.",
"items": {
"description": "Condition contains details for one aspect of the current state of this API Resource.",
"properties": {
"lastTransitionTime": {
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
"maxLength": 32768,
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
"format": "int64",
"minimum": 0,
"type": "integer"
},
"reason": {
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
"maxLength": 1024,
"minLength": 1,
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
"type": "string"
},
"status": {
"description": "status of the condition, one of True, False, Unknown.",
"enum": [
"True",
"False",
"Unknown"
],
"type": "string"
},
"type": {
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
"maxLength": 316,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"inventory": {
"description": "Inventory contains the list of generated ExternalArtifact references.",
"items": {
"description": "ExternalArtifactReference contains the reference to a\ngenerated ExternalArtifact along with its digest.",
"properties": {
"digest": {
"description": "Digest of the referent artifact.",
"type": "string"
},
"filename": {
"description": "Filename is the name of the artifact file.",
"type": "string"
},
"name": {
"description": "Name of the referent artifact.",
"type": "string"
},
"namespace": {
"description": "Namespace of the referent artifact.",
"type": "string"
}
},
"required": [
"digest",
"filename",
"name",
"namespace"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"lastHandledReconcileAt": {
"description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
"type": "string"
},
"observedSourcesDigest": {
"description": "ObservedSourcesDigest is a hash representing the current state of\nall the sources referenced by the ArtifactGenerator.",
"type": "string"
}
},
"type": "object",
"additionalProperties": false
}
},
"type": "object"
}{
"description": "Bucket is the Schema for the buckets API.",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"description": "BucketSpec specifies the required configuration to produce an Artifact for\nan object storage bucket.",
"properties": {
"bucketName": {
"description": "BucketName is the name of the object storage bucket.",
"type": "string"
},
"certSecretRef": {
"description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nbucket. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `generic` provider.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"endpoint": {
"description": "Endpoint is the object storage address the BucketName is located at.",
"type": "string"
},
"ignore": {
"description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
"type": "string"
},
"insecure": {
"description": "Insecure allows connecting to a non-TLS HTTP Endpoint.",
"type": "boolean"
},
"interval": {
"description": "Interval at which the Bucket Endpoint is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
"pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
"type": "string"
},
"prefix": {
"description": "Prefix to use for server-side filtering of files in the Bucket.",
"type": "string"
},
"provider": {
"default": "generic",
"description": "Provider of the object storage bucket.\nDefaults to 'generic', which expects an S3 (API) compatible object\nstorage.",
"enum": [
"generic",
"aws",
"gcp",
"azure"
],
"type": "string"
},
"proxySecretRef": {
"description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the Bucket server.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"region": {
"description": "Region of the Endpoint where the BucketName is located in.",
"type": "string"
},
"secretRef": {
"description": "SecretRef specifies the Secret containing authentication credentials\nfor the Bucket.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"serviceAccountName": {
"description": "ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate\nthe bucket. This field is only supported for the 'gcp' and 'aws' providers.\nFor more information about workload identity:\nhttps://fluxcd.io/flux/components/source/buckets/#workload-identity",
"type": "string"
},
"sts": {
"description": "STS specifies the required configuration to use a Security Token\nService for fetching temporary credentials to authenticate in a\nBucket provider.\n\nThis field is only supported for the `aws` and `generic` providers.",
"properties": {
"certSecretRef": {
"description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nSTS endpoint. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `ldap` provider.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"endpoint": {
"description": "Endpoint is the HTTP/S endpoint of the Security Token Service from\nwhere temporary credentials will be fetched.",
"pattern": "^(http|https)://.*$",
"type": "string"
},
"provider": {
"description": "Provider of the Security Token Service.",
"enum": [
"aws",
"ldap"
],
"type": "string"
},
"secretRef": {
"description": "SecretRef specifies the Secret containing authentication credentials\nfor the STS endpoint. This Secret must contain the fields `username`\nand `password` and is supported only for the `ldap` provider.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
}
},
"required": [
"endpoint",
"provider"
],
"type": "object",
"additionalProperties": false
},
"suspend": {
"description": "Suspend tells the controller to suspend the reconciliation of this\nBucket.",
"type": "boolean"
},
"timeout": {
"default": "60s",
"description": "Timeout for fetch operations, defaults to 60s.",
"pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
"type": "string"
}
},
"required": [
"bucketName",
"endpoint",
"interval"
],
"type": "object",
"x-kubernetes-validations": [
{
"message": "STS configuration is only supported for the 'aws' and 'generic' Bucket providers",
"rule": "self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)"
},
{
"message": "'aws' is the only supported STS provider for the 'aws' Bucket provider",
"rule": "self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws'"
},
{
"message": "'ldap' is the only supported STS provider for the 'generic' Bucket provider",
"rule": "self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap'"
},
{
"message": "spec.sts.secretRef is not required for the 'aws' STS provider",
"rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)"
},
{
"message": "spec.sts.certSecretRef is not required for the 'aws' STS provider",
"rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)"
},
{
"message": "ServiceAccountName is not supported for the 'generic' Bucket provider",
"rule": "self.provider != 'generic' || !has(self.serviceAccountName)"
},
{
"message": "cannot set both .spec.secretRef and .spec.serviceAccountName",
"rule": "!has(self.secretRef) || !has(self.serviceAccountName)"
}
],
"additionalProperties": false
},
"status": {
"default": {
"observedGeneration": -1
},
"description": "BucketStatus records the observed state of a Bucket.",
"properties": {
"artifact": {
"description": "Artifact represents the last successful Bucket reconciliation.",
"properties": {
"digest": {
"description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
"pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
"type": "string"
},
"lastUpdateTime": {
"description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
"format": "date-time",
"type": "string"
},
"metadata": {
"additionalProperties": {
"type": "string"
},
"description": "Metadata holds upstream information such as OCI annotations.",
"type": "object"
},
"path": {
"description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
"type": "string"
},
"revision": {
"description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
"type": "string"
},
"size": {
"description": "Size is the number of bytes in the file.",
"format": "int64",
"type": "integer"
},
"url": {
"description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
"type": "string"
}
},
"required": [
"digest",
"lastUpdateTime",
"path",
"revision",
"url"
],
"type": "object",
"additionalProperties": false
},
"conditions": {
"description": "Conditions holds the conditions for the Bucket.",
"items": {
"description": "Condition contains details for one aspect of the current state of this API Resource.",
"properties": {
"lastTransitionTime": {
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
"maxLength": 32768,
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
"format": "int64",
"minimum": 0,
"type": "integer"
},
"reason": {
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
"maxLength": 1024,
"minLength": 1,
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
"type": "string"
},
"status": {
"description": "status of the condition, one of True, False, Unknown.",
"enum": [
"True",
"False",
"Unknown"
],
"type": "string"
},
"type": {
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
"maxLength": 316,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"lastHandledReconcileAt": {
"description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
"type": "string"
},
"observedGeneration": {
"description": "ObservedGeneration is the last observed generation of the Bucket object.",
"format": "int64",
"type": "integer"
},
"observedIgnore": {
"description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
"type": "string"
},
"url": {
"description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
"type": "string"
}
},
"type": "object",
"additionalProperties": false
}
},
"type": "object"
}{
"description": "ExternalArtifact is the Schema for the external artifacts API",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"description": "ExternalArtifactSpec defines the desired state of ExternalArtifact",
"properties": {
"sourceRef": {
"description": "SourceRef points to the Kubernetes custom resource for\nwhich the artifact is generated.",
"properties": {
"apiVersion": {
"description": "API version of the referent, if not specified the Kubernetes preferred version will be used.",
"type": "string"
},
"kind": {
"description": "Kind of the referent.",
"type": "string"
},
"name": {
"description": "Name of the referent.",
"type": "string"
},
"namespace": {
"description": "Namespace of the referent, when not specified it acts as LocalObjectReference.",
"type": "string"
}
},
"required": [
"kind",
"name"
],
"type": "object",
"additionalProperties": false
}
},
"type": "object",
"additionalProperties": false
},
"status": {
"description": "ExternalArtifactStatus defines the observed state of ExternalArtifact",
"properties": {
"artifact": {
"description": "Artifact represents the output of an ExternalArtifact reconciliation.",
"properties": {
"digest": {
"description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
"pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
"type": "string"
},
"lastUpdateTime": {
"description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
"format": "date-time",
"type": "string"
},
"metadata": {
"additionalProperties": {
"type": "string"
},
"description": "Metadata holds upstream information such as OCI annotations.",
"type": "object"
},
"path": {
"description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
"type": "string"
},
"revision": {
"description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
"type": "string"
},
"size": {
"description": "Size is the number of bytes in the file.",
"format": "int64",
"type": "integer"
},
"url": {
"description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
"type": "string"
}
},
"required": [
"digest",
"lastUpdateTime",
"path",
"revision",
"url"
],
"type": "object",
"additionalProperties": false
},
"conditions": {
"description": "Conditions holds the conditions for the ExternalArtifact.",
"items": {
"description": "Condition contains details for one aspect of the current state of this API Resource.",
"properties": {
"lastTransitionTime": {
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
"maxLength": 32768,
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
"format": "int64",
"minimum": 0,
"type": "integer"
},
"reason": {
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
"maxLength": 1024,
"minLength": 1,
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
"type": "string"
},
"status": {
"description": "status of the condition, one of True, False, Unknown.",
"enum": [
"True",
"False",
"Unknown"
],
"type": "string"
},
"type": {
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
"maxLength": 316,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
}
},
"type": "object",
"additionalProperties": false
}
},
"type": "object"
}{
"description": "FluxInstance is the Schema for the fluxinstances API",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"additionalProperties": false,
"description": "FluxInstanceSpec defines the desired state of FluxInstance",
"properties": {
"cluster": {
"additionalProperties": false,
"description": "Cluster holds the specification of the Kubernetes cluster.",
"properties": {
"domain": {
"default": "cluster.local",
"description": "Domain is the cluster domain used for generating the FQDN of services.\nDefaults to 'cluster.local'.",
"type": "string"
},
"multitenant": {
"default": false,
"description": "Multitenant enables the multitenancy lockdown. Defaults to false.",
"type": "boolean"
},
"multitenantWorkloadIdentity": {
"default": false,
"description": "MultitenantWorkloadIdentity enables the multitenancy lockdown for\nworkload identity. Defaults to false.",
"type": "boolean"
},
"networkPolicy": {
"default": true,
"description": "NetworkPolicy restricts network access to the current namespace.\nDefaults to true.",
"type": "boolean"
},
"objectLevelWorkloadIdentity": {
"description": "ObjectLevelWorkloadIdentity enables the feature gate\nrequired for object-level workload identity.\nThis feature is only available in Flux v2.6.0 and later.",
"type": "boolean"
},
"size": {
"description": "Size defines the vertical scaling profile of the Flux controllers.\nThe size is used to determine the concurrency and CPU/Memory limits for the Flux controllers.\nAccepted values are: 'small', 'medium' and 'large'.",
"enum": [
"small",
"medium",
"large"
],
"type": "string"
},
"tenantDefaultDecryptionServiceAccount": {
"description": "TenantDefaultDecryptionServiceAccount is the name of the service account\nto use as default for kustomize-controller SOPS decryption when the\nmultitenant lockdown for workload identity is enabled. Defaults to the\n'default' service account from the tenant namespace.",
"type": "string"
},
"tenantDefaultKubeConfigServiceAccount": {
"description": "TenantDefaultKubeConfigServiceAccount is the name of the service account\nto use as default for kustomize-controller and helm-controller remote\ncluster access via spec.kubeConfig.configMapRef when the multitenant\nlockdown for workload identity is enabled. Defaults to the 'default'\nservice account from the tenant namespace.",
"type": "string"
},
"tenantDefaultServiceAccount": {
"description": "TenantDefaultServiceAccount is the name of the service account\nto use as default when the multitenant lockdown is enabled, for\nkustomize-controller and helm-controller.\nThis field will also be used for multitenant workload identity\nlockdown for source-controller, notification-controller,\nimage-reflector-controller and image-automation-controller.\nDefaults to the 'default' service account from the tenant namespace.",
"type": "string"
},
"type": {
"default": "kubernetes",
"description": "Type specifies the distro of the Kubernetes cluster.\nDefaults to 'kubernetes'.",
"enum": [
"kubernetes",
"openshift",
"aws",
"azure",
"gcp"
],
"type": "string"
}
},
"type": "object",
"x-kubernetes-validations": [
{
"message": ".objectLevelWorkloadIdentity must be set to true when .multitenantWorkloadIdentity is set to true",
"rule": "(has(self.objectLevelWorkloadIdentity) && self.objectLevelWorkloadIdentity) || !has(self.multitenantWorkloadIdentity) || !self.multitenantWorkloadIdentity"
}
]
},
"commonMetadata": {
"additionalProperties": false,
"description": "CommonMetadata specifies the common labels and annotations that are\napplied to all resources. Any existing label or annotation will be\noverridden if its key matches a common one.",
"properties": {
"annotations": {
"additionalProperties": {
"type": "string"
},
"description": "Annotations to be added to the object's metadata.",
"type": "object"
},
"labels": {
"additionalProperties": {
"type": "string"
},
"description": "Labels to be added to the object's metadata.",
"type": "object"
}
},
"type": "object"
},
"components": {
"description": "Components is the list of controllers to install.\nDefaults to the core Flux controllers:\n - source-controller\n - kustomize-controller\n - helm-controller\n - notification-controller",
"items": {
"description": "Component is the name of a controller to install.",
"enum": [
"source-controller",
"kustomize-controller",
"helm-controller",
"notification-controller",
"image-reflector-controller",
"image-automation-controller",
"source-watcher"
],
"type": "string"
},
"type": "array"
},
"distribution": {
"additionalProperties": false,
"description": "Distribution specifies the version and container registry to pull images from.",
"properties": {
"artifact": {
"description": "Artifact is the URL to the OCI artifact containing\nthe latest Kubernetes manifests for the distribution,\ne.g. 'oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest'.",
"pattern": "^oci://.*$",
"type": "string"
},
"artifactPullSecret": {
"description": "ArtifactPullSecret is the name of the Kubernetes secret\nto use for pulling the Kubernetes manifests for the distribution specified in the Artifact field.",
"type": "string"
},
"imagePullSecret": {
"description": "ImagePullSecret is the name of the Kubernetes secret\nto use for pulling images.",
"type": "string"
},
"registry": {
"description": "Registry address to pull the distribution images from\ne.g. 'ghcr.io/fluxcd'.",
"type": "string"
},
"variant": {
"description": "Variant specifies the Flux distribution flavor stored\nin the registry.",
"enum": [
"upstream-alpine",
"enterprise-alpine",
"enterprise-distroless",
"enterprise-distroless-fips"
],
"type": "string"
},
"version": {
"description": "Version semver expression e.g. '2.x', '2.3.x'.",
"type": "string"
}
},
"required": [
"registry",
"version"
],
"type": "object"
},
"kustomize": {
"additionalProperties": false,
"description": "Kustomize holds a set of patches that can be applied to the\nFlux installation, to customize the way Flux operates.",
"properties": {
"patches": {
"description": "Strategic merge and JSON patches, defined as inline YAML objects,\ncapable of targeting objects based on kind, label and annotation selectors.",
"items": {
"additionalProperties": false,
"description": "Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should\nbe applied to.",
"properties": {
"patch": {
"description": "Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with\nan array of operation objects.",
"type": "string"
},
"target": {
"additionalProperties": false,
"description": "Target points to the resources that the patch document should be applied to.",
"properties": {
"annotationSelector": {
"description": "AnnotationSelector is a string that follows the label selection expression\nhttps://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\nIt matches with the resource annotations.",
"type": "string"
},
"group": {
"description": "Group is the API group to select resources from.\nTogether with Version and Kind it is capable of unambiguously identifying and/or selecting resources.\nhttps://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md",
"type": "string"
},
"kind": {
"description": "Kind of the API Group to select resources from.\nTogether with Group and Version it is capable of unambiguously\nidentifying and/or selecting resources.\nhttps://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md",
"type": "string"
},
"labelSelector": {
"description": "LabelSelector is a string that follows the label selection expression\nhttps://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api\nIt matches with the resource labels.",
"type": "string"
},
"name": {
"description": "Name to match resources with.",
"type": "string"
},
"namespace": {
"description": "Namespace to select resources from.",
"type": "string"
},
"version": {
"description": "Version of the API Group to select resources from.\nTogether with Group and Kind it is capable of unambiguously identifying and/or selecting resources.\nhttps://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md",
"type": "string"
}
},
"type": "object"
}
},
"required": [
"patch"
],
"type": "object"
},
"type": "array"
}
},
"type": "object"
},
"migrateResources": {
"default": true,
"description": "MigrateResources instructs the controller to migrate the Flux custom resources\nfrom the previous version to the latest API version specified in the CRD.\nDefaults to true.",
"type": "boolean"
},
"sharding": {
"additionalProperties": false,
"description": "Sharding holds the specification of the sharding configuration.",
"properties": {
"key": {
"default": "sharding.fluxcd.io/key",
"description": "Key is the label key used to shard the resources.",
"type": "string"
},
"shards": {
"description": "Shards is the list of shard names.",
"items": {
"type": "string"
},
"minItems": 1,
"type": "array"
},
"storage": {
"description": "Storage defines if the source-controller shards\nshould use an emptyDir or a persistent volume claim for storage.\nAccepted values are 'ephemeral' or 'persistent', defaults to 'ephemeral'.\nFor 'persistent' to take effect, the '.spec.storage' field must be set.",
"enum": [
"ephemeral",
"persistent"
],
"type": "string"
}
},
"required": [
"shards"
],
"type": "object"
},
"storage": {
"additionalProperties": false,
"description": "Storage holds the specification of the source-controller\npersistent volume claim.",
"properties": {
"class": {
"description": "Class is the storage class to use for the PVC.",
"type": "string"
},
"size": {
"description": "Size is the size of the PVC.",
"type": "string"
}
},
"required": [
"class",
"size"
],
"type": "object"
},
"sync": {
"additionalProperties": false,
"description": "Sync specifies the source for the cluster sync operation.\nWhen set, a Flux source (GitRepository, OCIRepository or Bucket)\nand Flux Kustomization are created to sync the cluster state\nwith the source repository.",
"properties": {
"interval": {
"default": "1m",
"description": "Interval is the time between syncs.",
"pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
"type": "string"
},
"kind": {
"description": "Kind is the kind of the source.",
"enum": [
"OCIRepository",
"GitRepository",
"Bucket"
],
"type": "string"
},
"name": {
"description": "Name is the name of the Flux source and kustomization resources.\nWhen not specified, the name is set to the namespace name of the FluxInstance.",
"maxLength": 63,
"type": "string",
"x-kubernetes-validations": [
{
"message": "Sync name is immutable",
"rule": "self == oldSelf"
}
]
},
"path": {
"description": "Path is the path to the source directory containing\nthe kustomize overlay or plain Kubernetes manifests.",
"type": "string"
},
"provider": {
"description": "Provider specifies OIDC provider for source authentication.\nFor OCIRepository and Bucket the provider can be set to 'aws', 'azure' or 'gcp'.\nFor GitRepository the provider can be set to 'aws' (requires Flux 2.9 or later),\n'azure' or 'github'.\nTo disable OIDC authentication the provider can be set to 'generic' or left empty.",
"enum": [
"generic",
"aws",
"azure",
"gcp",
"github"
],
"type": "string"
},
"pullSecret": {
"description": "PullSecret specifies the Kubernetes Secret containing the\nauthentication credentials for the source.\nFor Git over HTTP/S sources, the secret must contain username and password fields.\nFor Git over SSH sources, the secret must contain known_hosts and identity fields.\nFor OCI sources, the secret must be of type kubernetes.io/dockerconfigjson.\nFor Bucket sources, the secret must contain accesskey and secretkey fields.",
"type": "string"
},
"ref": {
"description": "Ref is the source reference, can be a Git ref name e.g. 'refs/heads/main',\nan OCI tag e.g. 'latest' or a bucket name e.g. 'flux'.",
"type": "string"
},
"url": {
"description": "URL is the source URL, can be a Git repository HTTP/S or SSH address,\nan OCI repository address or a Bucket endpoint.",
"type": "string"
}
},
"required": [
"kind",
"path",
"ref",
"url"
],
"type": "object",
"x-kubernetes-validations": [
{
"message": "sync.provider 'gcp' is only supported for OCIRepository and Bucket",
"rule": "!has(self.provider) || self.provider != 'gcp' || self.kind == 'OCIRepository' || self.kind == 'Bucket'"
},
{
"message": "sync.provider 'github' is only supported for GitRepository",
"rule": "!has(self.provider) || self.provider != 'github' || self.kind == 'GitRepository'"
}
]
},
"wait": {
"default": true,
"description": "Wait instructs the controller to check the health of all the reconciled\nresources. Defaults to true.",
"type": "boolean"
}
},
"required": [
"distribution"
],
"type": "object"
},
"status": {
"additionalProperties": false,
"description": "FluxInstanceStatus defines the observed state of FluxInstance",
"properties": {
"components": {
"description": "Components contains the container images used by the components.",
"items": {
"additionalProperties": false,
"description": "ComponentImage represents a container image used by a component.",
"properties": {
"digest": {
"description": "Digest of the container image.",
"type": "string"
},
"name": {
"description": "Name of the component.",
"type": "string"
},
"repository": {
"description": "Repository address of the container image.",
"type": "string"
},
"tag": {
"description": "Tag of the container image.",
"type": "string"
}
},
"required": [
"name",
"repository",
"tag"
],
"type": "object"
},
"type": "array"
},
"conditions": {
"description": "Conditions contains the readiness conditions of the object.",
"items": {
"additionalProperties": false,
"description": "Condition contains details for one aspect of the current state of this API Resource.",
"properties": {
"lastTransitionTime": {
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
"maxLength": 32768,
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
"format": "int64",
"minimum": 0,
"type": "integer"
},
"reason": {
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
"maxLength": 1024,
"minLength": 1,
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
"type": "string"
},
"status": {
"description": "status of the condition, one of True, False, Unknown.",
"enum": [
"True",
"False",
"Unknown"
],
"type": "string"
},
"type": {
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
"maxLength": 316,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object"
},
"type": "array"
},
"history": {
"description": "History contains the reconciliation history of the FluxInstance\nas a list of snapshots ordered by the last reconciled time.",
"items": {
"additionalProperties": false,
"description": "Snapshot represents a point-in-time record of a group of resources reconciliation,\nincluding timing information, status, and a unique digest identifier.",
"properties": {
"digest": {
"description": "Digest is the checksum in the format `<algo>:<hex>` of the resources in this snapshot.",
"type": "string"
},
"firstReconciled": {
"description": "FirstReconciled is the time when this revision was first reconciled to the cluster.",
"format": "date-time",
"type": "string"
},
"lastReconciled": {
"description": "LastReconciled is the time when this revision was last reconciled to the cluster.",
"format": "date-time",
"type": "string"
},
"lastReconciledDuration": {
"description": "LastReconciledDuration is time it took to reconcile the resources in this revision.",
"type": "string"
},
"lastReconciledStatus": {
"description": "LastReconciledStatus is the status of the last reconciliation.",
"type": "string"
},
"metadata": {
"additionalProperties": {
"type": "string"
},
"description": "Metadata contains additional information about the snapshot.",
"type": "object"
},
"totalReconciliations": {
"description": "TotalReconciliations is the total number of reconciliations that have occurred for this snapshot.",
"format": "int64",
"type": "integer"
}
},
"required": [
"digest",
"firstReconciled",
"lastReconciled",
"lastReconciledDuration",
"lastReconciledStatus",
"totalReconciliations"
],
"type": "object"
},
"type": "array"
},
"inventory": {
"additionalProperties": false,
"description": "Inventory contains a list of Kubernetes resource object references\nlast applied on the cluster.",
"properties": {
"entries": {
"description": "Entries of Kubernetes resource object references.",
"items": {
"additionalProperties": false,
"description": "ResourceRef contains the information necessary to locate a resource within a cluster.",
"properties": {
"id": {
"description": "ID is the string representation of the Kubernetes resource object's metadata,\nin the format '<namespace>_<name>_<group>_<kind>'.",
"type": "string"
},
"v": {
"description": "Version is the API version of the Kubernetes resource object's kind.",
"type": "string"
}
},
"required": [
"id",
"v"
],
"type": "object"
},
"type": "array"
}
},
"required": [
"entries"
],
"type": "object"
},
"lastAppliedRevision": {
"description": "LastAppliedRevision is the version and digest of the\ndistribution config that was last reconcile.",
"type": "string"
},
"lastArtifactRevision": {
"description": "LastArtifactRevision is the digest of the last pulled\ndistribution artifact.",
"type": "string"
},
"lastAttemptedRevision": {
"description": "LastAttemptedRevision is the version and digest of the\ndistribution config that was last attempted to reconcile.",
"type": "string"
},
"lastHandledForceAt": {
"description": "LastHandledForceAt holds the value of the most recent\nforce request value, so a change of the annotation value\ncan be detected.",
"type": "string"
},
"lastHandledReconcileAt": {
"description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
"type": "string"
}
},
"type": "object"
}
},
"type": "object",
"x-kubernetes-validations": [
{
"message": "the only accepted name for a FluxInstance is 'flux'",
"rule": "self.metadata.name == 'flux'"
}
]
}
{
"description": "FluxReport is the Schema for the fluxreports API.",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"additionalProperties": false,
"description": "FluxReportSpec defines the observed state of a Flux installation.",
"properties": {
"cluster": {
"additionalProperties": false,
"description": "Cluster is the version information of the Kubernetes cluster.",
"properties": {
"nodes": {
"description": "Nodes is the number of nodes in the Kubernetes cluster.",
"type": "integer"
},
"platform": {
"description": "Platform is the os/arch of the Kubernetes control plane.",
"type": "string"
},
"serverVersion": {
"description": "ServerVersion is the version of the Kubernetes API server.",
"type": "string"
}
},
"required": [
"platform",
"serverVersion"
],
"type": "object"
},
"components": {
"description": "ComponentsStatus is the status of the Flux controller deployments.",
"items": {
"additionalProperties": false,
"description": "FluxComponentStatus defines the observed state of a Flux component.",
"properties": {
"image": {
"description": "Image is the container image of the Flux component.",
"type": "string"
},
"name": {
"description": "Name is the name of the Flux component.",
"type": "string"
},
"ready": {
"description": "Ready is the readiness status of the Flux component.",
"type": "boolean"
},
"status": {
"description": "Status is a human-readable message indicating details\nabout the Flux component observed state.",
"type": "string"
}
},
"required": [
"image",
"name",
"ready",
"status"
],
"type": "object"
},
"type": "array"
},
"distribution": {
"additionalProperties": false,
"description": "Distribution is the version information of the Flux installation.",
"properties": {
"entitlement": {
"description": "Entitlement is the entitlement verification status.",
"type": "string"
},
"managedBy": {
"description": "ManagedBy is the name of the operator managing the Flux instance.",
"type": "string"
},
"status": {
"description": "Status is a human-readable message indicating details\nabout the distribution observed state.",
"type": "string"
},
"version": {
"description": "Version is the version of the Flux instance.",
"type": "string"
}
},
"required": [
"entitlement",
"status"
],
"type": "object"
},
"operator": {
"additionalProperties": false,
"description": "Operator is the version information of the Flux Operator.",
"properties": {
"apiVersion": {
"description": "APIVersion is the API version of the Flux Operator.",
"type": "string"
},
"platform": {
"description": "Platform is the os/arch of Flux Operator.",
"type": "string"
},
"version": {
"description": "Version is the version number of Flux Operator.",
"type": "string"
}
},
"required": [
"apiVersion",
"platform",
"version"
],
"type": "object"
},
"reconcilers": {
"description": "ReconcilersStatus is the list of Flux reconcilers and\ntheir statistics grouped by API kind.",
"items": {
"additionalProperties": false,
"description": "FluxReconcilerStatus defines the observed state of a Flux reconciler.",
"properties": {
"apiVersion": {
"description": "APIVersion is the API version of the Flux resource.",
"type": "string"
},
"kind": {
"description": "Kind is the kind of the Flux resource.",
"type": "string"
},
"stats": {
"additionalProperties": false,
"description": "Stats is the reconcile statics of the Flux resource kind.",
"properties": {
"failing": {
"description": "Failing is the number of reconciled\nresources in the Failing state and not Suspended.",
"type": "integer"
},
"running": {
"description": "Running is the number of reconciled\nresources in the Running state.",
"type": "integer"
},
"suspended": {
"description": "Suspended is the number of reconciled\nresources in the Suspended state.",
"type": "integer"
},
"totalSize": {
"description": "TotalSize is the total size of the artifacts in storage.",
"type": "string"
}
},
"required": [
"failing",
"running",
"suspended"
],
"type": "object"
}
},
"required": [
"apiVersion",
"kind"
],
"type": "object"
},
"type": "array"
},
"sync": {
"additionalProperties": false,
"description": "SyncStatus is the status of the cluster sync\nSource and Kustomization resources.",
"properties": {
"id": {
"description": "ID is the identifier of the sync.",
"type": "string"
},
"path": {
"description": "Path is the kustomize path of the sync.",
"type": "string"
},
"ready": {
"description": "Ready is the readiness status of the sync.",
"type": "boolean"
},
"source": {
"description": "Source is the URL of the source repository.",
"type": "string"
},
"status": {
"description": "Status is a human-readable message indicating details\nabout the sync observed state.",
"type": "string"
}
},
"required": [
"id",
"ready",
"status"
],
"type": "object"
}
},
"required": [
"distribution"
],
"type": "object"
},
"status": {
"additionalProperties": false,
"description": "FluxReportStatus defines the readiness of a FluxReport.",
"properties": {
"conditions": {
"description": "Conditions contains the readiness conditions of the object.",
"items": {
"additionalProperties": false,
"description": "Condition contains details for one aspect of the current state of this API Resource.",
"properties": {
"lastTransitionTime": {
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
"maxLength": 32768,
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
"format": "int64",
"minimum": 0,
"type": "integer"
},
"reason": {
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
"maxLength": 1024,
"minLength": 1,
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
"type": "string"
},
"status": {
"description": "status of the condition, one of True, False, Unknown.",
"enum": [
"True",
"False",
"Unknown"
],
"type": "string"
},
"type": {
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
"maxLength": 316,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object"
},
"type": "array"
},
"lastHandledReconcileAt": {
"description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
"type": "string"
}
},
"type": "object"
}
},
"type": "object",
"x-kubernetes-validations": [
{
"message": "the only accepted name for a FluxReport is 'flux'",
"rule": "self.metadata.name == 'flux'"
}
]
}
{
"description": "GitRepository is the Schema for the gitrepositories API.",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"description": "GitRepositorySpec specifies the required configuration to produce an\nArtifact for a Git repository.",
"properties": {
"ignore": {
"description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
"type": "string"
},
"include": {
"description": "Include specifies a list of GitRepository resources which Artifacts\nshould be included in the Artifact produced for this GitRepository.",
"items": {
"description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
"properties": {
"fromPath": {
"description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
"type": "string"
},
"repository": {
"description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"toPath": {
"description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
"type": "string"
}
},
"required": [
"repository"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"interval": {
"description": "Interval at which the GitRepository URL is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
"pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
"type": "string"
},
"provider": {
"description": "Provider used for authentication, can be 'azure', 'github', 'generic'.\nWhen not specified, defaults to 'generic'.",
"enum": [
"generic",
"azure",
"github"
],
"type": "string"
},
"proxySecretRef": {
"description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the Git server.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"recurseSubmodules": {
"description": "RecurseSubmodules enables the initialization of all submodules within\nthe GitRepository as cloned from the URL, using their default settings.",
"type": "boolean"
},
"ref": {
"description": "Reference specifies the Git reference to resolve and monitor for\nchanges, defaults to the 'master' branch.",
"properties": {
"branch": {
"description": "Branch to check out, defaults to 'master' if no other field is defined.",
"type": "string"
},
"commit": {
"description": "Commit SHA to check out, takes precedence over all reference fields.\n\nThis can be combined with Branch to shallow clone the branch, in which\nthe commit is expected to exist.",
"type": "string"
},
"name": {
"description": "Name of the reference to check out; takes precedence over Branch, Tag and SemVer.\n\nIt must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description\nExamples: \"refs/heads/main\", \"refs/tags/v0.1.0\", \"refs/pull/420/head\", \"refs/merge-requests/1/head\"",
"type": "string"
},
"semver": {
"description": "SemVer tag expression to check out, takes precedence over Tag.",
"type": "string"
},
"tag": {
"description": "Tag to check out, takes precedence over Branch.",
"type": "string"
}
},
"type": "object",
"additionalProperties": false
},
"secretRef": {
"description": "SecretRef specifies the Secret containing authentication credentials for\nthe GitRepository.\nFor HTTPS repositories the Secret must contain 'username' and 'password'\nfields for basic auth or 'bearerToken' field for token auth.\nFor SSH repositories the Secret must contain 'identity'\nand 'known_hosts' fields.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"serviceAccountName": {
"description": "ServiceAccountName is the name of the Kubernetes ServiceAccount used to\nauthenticate to the GitRepository. This field is only supported for 'azure' provider.",
"type": "string"
},
"sparseCheckout": {
"description": "SparseCheckout specifies a list of directories to checkout when cloning\nthe repository. If specified, only these directories are included in the\nArtifact produced for this GitRepository.",
"items": {
"type": "string"
},
"type": "array"
},
"suspend": {
"description": "Suspend tells the controller to suspend the reconciliation of this\nGitRepository.",
"type": "boolean"
},
"timeout": {
"default": "60s",
"description": "Timeout for Git operations like cloning, defaults to 60s.",
"pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
"type": "string"
},
"url": {
"description": "URL specifies the Git repository URL, it can be an HTTP/S or SSH address.",
"pattern": "^(http|https|ssh)://.*$",
"type": "string"
},
"verify": {
"description": "Verification specifies the configuration to verify the Git commit\nsignature(s).",
"properties": {
"mode": {
"default": "HEAD",
"description": "Mode specifies which Git object(s) should be verified.\n\nThe variants \"head\" and \"HEAD\" both imply the same thing, i.e. verify\nthe commit that the HEAD of the Git repository points to. The variant\n\"head\" solely exists to ensure backwards compatibility.",
"enum": [
"head",
"HEAD",
"Tag",
"TagAndHEAD"
],
"type": "string"
},
"secretRef": {
"description": "SecretRef specifies the Secret containing the public keys of trusted Git\nauthors.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
}
},
"required": [
"secretRef"
],
"type": "object",
"additionalProperties": false
}
},
"required": [
"interval",
"url"
],
"type": "object",
"x-kubernetes-validations": [
{
"message": "serviceAccountName can only be set when provider is 'azure'",
"rule": "!has(self.serviceAccountName) || (has(self.provider) && self.provider == 'azure')"
}
],
"additionalProperties": false
},
"status": {
"default": {
"observedGeneration": -1
},
"description": "GitRepositoryStatus records the observed state of a Git repository.",
"properties": {
"artifact": {
"description": "Artifact represents the last successful GitRepository reconciliation.",
"properties": {
"digest": {
"description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
"pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
"type": "string"
},
"lastUpdateTime": {
"description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
"format": "date-time",
"type": "string"
},
"metadata": {
"additionalProperties": {
"type": "string"
},
"description": "Metadata holds upstream information such as OCI annotations.",
"type": "object"
},
"path": {
"description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
"type": "string"
},
"revision": {
"description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
"type": "string"
},
"size": {
"description": "Size is the number of bytes in the file.",
"format": "int64",
"type": "integer"
},
"url": {
"description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
"type": "string"
}
},
"required": [
"digest",
"lastUpdateTime",
"path",
"revision",
"url"
],
"type": "object",
"additionalProperties": false
},
"conditions": {
"description": "Conditions holds the conditions for the GitRepository.",
"items": {
"description": "Condition contains details for one aspect of the current state of this API Resource.",
"properties": {
"lastTransitionTime": {
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
"maxLength": 32768,
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
"format": "int64",
"minimum": 0,
"type": "integer"
},
"reason": {
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
"maxLength": 1024,
"minLength": 1,
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
"type": "string"
},
"status": {
"description": "status of the condition, one of True, False, Unknown.",
"enum": [
"True",
"False",
"Unknown"
],
"type": "string"
},
"type": {
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
"maxLength": 316,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"includedArtifacts": {
"description": "IncludedArtifacts contains a list of the last successfully included\nArtifacts as instructed by GitRepositorySpec.Include.",
"items": {
"description": "Artifact represents the output of a Source reconciliation.",
"properties": {
"digest": {
"description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
"pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
"type": "string"
},
"lastUpdateTime": {
"description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
"format": "date-time",
"type": "string"
},
"metadata": {
"additionalProperties": {
"type": "string"
},
"description": "Metadata holds upstream information such as OCI annotations.",
"type": "object"
},
"path": {
"description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
"type": "string"
},
"revision": {
"description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
"type": "string"
},
"size": {
"description": "Size is the number of bytes in the file.",
"format": "int64",
"type": "integer"
},
"url": {
"description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
"type": "string"
}
},
"required": [
"digest",
"lastUpdateTime",
"path",
"revision",
"url"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"lastHandledReconcileAt": {
"description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
"type": "string"
},
"observedGeneration": {
"description": "ObservedGeneration is the last observed generation of the GitRepository\nobject.",
"format": "int64",
"type": "integer"
},
"observedIgnore": {
"description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
"type": "string"
},
"observedInclude": {
"description": "ObservedInclude is the observed list of GitRepository resources used to\nproduce the current Artifact.",
"items": {
"description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
"properties": {
"fromPath": {
"description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
"type": "string"
},
"repository": {
"description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"toPath": {
"description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
"type": "string"
}
},
"required": [
"repository"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"observedRecurseSubmodules": {
"description": "ObservedRecurseSubmodules is the observed resource submodules\nconfiguration used to produce the current Artifact.",
"type": "boolean"
},
"observedSparseCheckout": {
"description": "ObservedSparseCheckout is the observed list of directories used to\nproduce the current Artifact.",
"items": {
"type": "string"
},
"type": "array"
},
"sourceVerificationMode": {
"description": "SourceVerificationMode is the last used verification mode indicating\nwhich Git object(s) have been verified.",
"type": "string"
}
},
"type": "object",
"additionalProperties": false
}
},
"type": "object"
}{
"description": "Provider is the Schema for the providers API.",
"properties": {
"apiVersion": {
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
"type": "string"
},
"kind": {
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
"type": "string"
},
"metadata": {
"type": "object"
},
"spec": {
"description": "ProviderSpec defines the desired state of the Provider.",
"properties": {
"address": {
"description": "Address specifies the endpoint, in a generic sense, to where alerts are sent.\nWhat kind of endpoint depends on the specific Provider type being used.\nFor the generic Provider, for example, this is an HTTP/S address.\nFor other Provider types this could be a project ID or a namespace.",
"maxLength": 2048,
"type": "string"
},
"certSecretRef": {
"description": "CertSecretRef specifies the Secret containing\na PEM-encoded CA certificate (in the `ca.crt` key).\n\nNote: Support for the `caFile` key has\nbeen deprecated.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"channel": {
"description": "Channel specifies the destination channel where events should be posted.",
"maxLength": 2048,
"type": "string"
},
"interval": {
"description": "Interval at which to reconcile the Provider with its Secret references.",
"pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
"type": "string"
},
"proxy": {
"description": "Proxy the HTTP/S address of the proxy server.",
"maxLength": 2048,
"pattern": "^(http|https)://.*$",
"type": "string"
},
"secretRef": {
"description": "SecretRef specifies the Secret containing the authentication\ncredentials for this Provider.",
"properties": {
"name": {
"description": "Name of the referent.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"suspend": {
"description": "Suspend tells the controller to suspend subsequent\nevents handling for this Provider.",
"type": "boolean"
},
"timeout": {
"description": "Timeout for sending alerts to the Provider.",
"pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
"type": "string"
},
"type": {
"description": "Type specifies which Provider implementation to use.",
"enum": [
"slack",
"discord",
"msteams",
"rocket",
"generic",
"generic-hmac",
"github",
"gitlab",
"gitea",
"bitbucketserver",
"bitbucket",
"azuredevops",
"googlechat",
"googlepubsub",
"webex",
"sentry",
"azureeventhub",
"telegram",
"lark",
"matrix",
"opsgenie",
"alertmanager",
"grafana",
"githubdispatch",
"pagerduty",
"datadog"
],
"type": "string"
},
"username": {
"description": "Username specifies the name under which events are posted.",
"maxLength": 2048,
"type": "string"
}
},
"required": [
"type"
],
"type": "object",
"additionalProperties": false
},
"status": {
"default": {
"observedGeneration": -1
},
"description": "ProviderStatus defines the observed state of the Provider.",
"properties": {
"conditions": {
"description": "Conditions holds the conditions for the Provider.",
"items": {
"description": "Condition contains details for one aspect of the current state of this API Resource.",
"properties": {
"lastTransitionTime": {
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
"maxLength": 32768,
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
"format": "int64",
"minimum": 0,
"type": "integer"
},
"reason": {
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
"maxLength": 1024,
"minLength": 1,
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
"type": "string"
},
"status": {
"description": "status of the condition, one of True, False, Unknown.",
"enum": [
"True",
"False",
"Unknown"
],
"type": "string"
},
"type": {
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
"maxLength": 316,
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"lastHandledReconcileAt": {
"description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
"type": "string"
},
"observedGeneration": {
"description": "ObservedGeneration is the last reconciled generation.",
"format": "int64",
"type": "integer"
}
},
"type": "object",
"additionalProperties": false
}
},
"type": "object"
}Related skills
Lark Openapi ExplorerInstantly explore, test, and generate calls against the full Lark (Feishu) OpenAPI surface without leaving their agent workflow.493k
Lark EventConsume real-time events from Lark/Feishu as structured NDJSON streams inside AI agent workflows.387k16kLark Openapi ExplorerWhen an existing Lark/Feishu skill or CLI command cannot fulfill a specific requirement and they need to discover and invoke the exact native OpenAPI endpoint.386k16k
Just ScrapeQuickly search, crawl, extract structured JSON, or monitor web pages without writing custom scraping code.245k41Lark AppsQuery the current visibility and permission scope of a Lark (Feishu) app without writing HTTP client code.235k16k
Design An InterfaceGenerate multiple radically different interface or API designs in parallel before committing to one.188k198kHow it compares
Pick gitops-cluster-debug over generic Kubernetes skills when failures involve Flux reconciliation status, GitOps dependency chains, or flux-operator-mcp live cluster inspection.
FAQ
What does gitops-cluster-debug require?
gitops-cluster-debug requires the flux-operator-mcp MCP server connected to a live Kubernetes cluster. On context switch it calls get_flux_instance to verify Flux Operator status, version, and settings before inspecting resources.
Which Flux resources can gitops-cluster-debug trace?
gitops-cluster-debug traces FluxInstance, HelmRelease, Kustomization, ResourceSet, GitRepository, OCIRepository, and image automation CRDs. It follows source-to-applier-to-managed-resource chains and analyzes controller pod logs for root causes.
Backend & APIsbackend